Privacy notice

This notice explains how personal data is handled in Prodermis Academy (“the Academy”), a private training library for medical professionals who are Prodermis customers.

The controller of your personal data is [Prodermis legal entity name], [registered address], company number [company number] (“Prodermis”, “we”, “us”). For any data-protection question, contact [data-protection contact email]. [data protection officer and UK/EU representative, if either is required]

Prodermis works with authorised distributors, who review requests and support doctors in their countries. [confirm with Prodermis’s legal adviser whether distributors act for Prodermis (as processors) or as separate controllers, and say so here]

When you request access:

• your full name, email address and phone or WhatsApp number
• your clinic or practice, city and country of practice
• your profession and your medical licence or registration number
• if you choose to give them: who you bought Prodermis from, and your clinic’s Instagram account and website
• the invoice you upload as proof of purchase (a PDF, JPG or PNG file of up to 10 MB)
• the language you filled the form in, the versions of the terms and this notice you agreed to, and the distributor sign-up link you used, if any

When you use the Academy:

• your account: name, email address, country, preferred language, and your password, which is stored only in a scrambled (hashed) form that we cannot read
• your membership: approval, renewal and suspension dates, and the reasons recorded with them
• your sign-in sessions: when you signed in, your IP address and your browser and device type
• a record of the emails we send you
• a record of important actions — for example each decision on your request, and each time a member of staff opens your invoice

To stop repeated attempts (for example many sign-up requests in a row), we briefly keep a counter linked to your IP address or email address, which is deleted when its time window ends.

If the Academy is served through Cloudflare’s network, we are told which country your connection comes from. We use this only at that moment, to withhold country-restricted training, and we do not store it.

We do not use analytics or advertising trackers, and the Academy does not keep a record of which videos you watch.

• To check that you are a medical professional and a Prodermis customer before giving you access.
• To run your account, give you access for 12 months, and handle renewals.
• To email you about your request, your account and your access.
• To keep the Academy secure and prevent shared accounts and misuse.
• To withhold training in countries where it may not be shown.

We rely on the following legal bases: performing our agreement with you (your account and access); our legitimate interests in confirming that only Prodermis customers use the Academy and in keeping it secure; and complying with legal and regulatory obligations. [legal bases to be confirmed by Prodermis’s legal adviser]

We do not make automated decisions about you: every request is reviewed by a person.

• Prodermis head-office staff who manage Academy access.
• Your distributor’s team. Your request is assigned to the distributor whose sign-up link you used, or otherwise to the distributor responsible for your country. That distributor can see your request, your invoice and your account status. Each distributor sees only the doctors assigned to it. If you are moved to another distributor, the new one can see your record; if Prodermis stops working with a distributor, its team loses access.
• Staff and distributor teams must use two-step login, and every time someone opens an invoice it is recorded.
• Our service providers, listed below, who act only on our instructions.

We do not sell your data. [any other disclosures, for example to authorities where the law requires it]

• Render — hosts the Academy and its database, in Frankfurt, Germany.
• Cloudflare R2 — stores uploaded invoices, in storage restricted to the European Union.
• Mailgun — sends our emails, from its European Union region.
• Mux — streams the training videos. Mux receives what any video stream needs, such as your IP address and device type, and may collect technical playback-quality data. It is not given your name or email address, and the player is set not to use cookies.

[international transfers: confirm the safeguards (for example Standard Contractual Clauses and the UK addendum) for any provider that may process data outside the UK or EEA, including Mux]

[add Cloudflare (network and security) once academy.prodermis.com is served through it]

• Invoices: deleted 90 days after the final decision on your request. Backup copies may remain for up to [backup retention period] after that.
• Sign-in sessions: up to 30 days, or until you log out.
• Links in our emails expire: email confirmation after 24 hours; choosing your password after 7 days; sending us a new document after 14 days; checking the status of your request after 30 days.
• Counters used to stop repeated attempts: deleted when their time window ends.
• Your account, requests, emails sent and the record of actions: [retention period to be decided by Prodermis — the Academy does not currently delete these automatically]

We use only the cookies the Academy needs to work:

• a sign-in cookie that keeps you logged in, for up to 30 days. Staff also receive a short-lived cookie while completing two-step login.
• NEXT_LOCALE, which remembers the language you choose, for one year.

We do not use analytics, advertising or tracking cookies, and the video player is set not to use cookies. [before launch: if the site is served through Cloudflare, check whether Cloudflare adds any security cookies and list them here]

• Invoices are kept in private storage with no public link. They can only be opened by signed-in staff or distributor team members who are allowed to see your request. Photos are re-processed before they are shown, which removes hidden information such as location data.
• Passwords are stored only in scrambled (hashed) form.
• Staff and distributor teams must use two-step login.
• Every request to watch training is checked again on our server, including whether your access is still current.

Under the UK GDPR and the EU GDPR, you have the right to:

• ask for a copy of your personal data
• have inaccurate data corrected
• ask for your data to be deleted — which will end your access to the Academy
• object to, or ask us to restrict, how we use your data
• receive the data you gave us in a portable format

To use any of these rights, contact [data-protection contact email]. We may need to confirm your identity first. You can also complain to a data-protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the European Union, the authority in the country where you live or work.

Each version of this notice has a version number, shown at the top of this page. When you request access, we record which version you were shown.